sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

More documents

Recommendations

Info

4.5. Logging file list The malware saves ~rf files in /windows/temp. This operation seems to be automatic, but perhaps it may also be remotely controlled. These files are encrypted with the E1 encryption algorithm (see above). After decryption, the file appears to be an SQLite3 database, storing information on drivers, directories, and file names. Figure 37 – SQLite database format for ~rf files [file db] Laboratory of Cryptography and System Security (CrySyS) Budapest University of Technology and Economics www.crysys.hu 38
Discussion: Figure 38 –File list of the file system in the ~rf files Storing full directory listing in SQLite databases is something you won’t expect from a malware. It’s very strange as it raises complexity and the need for space, and in addition it leaks information through the database structure. Note that the “SQLite browser” application cannot see full filenames as they are stored in Unicode format in blob entries, and the first \x00 stops viewing them. 4.6. Saving additional information The malware is curious about lot of things. Some examples from the long list of interests are shown in the figure below: Laboratory of Cryptography and System Security (CrySyS) Budapest University of Technology and Economics www.crysys.hu 39
Page 1 and 2: sKyWIper (a.k.a. Flame a.k.a. Flame
Page 3 and 4: structured format in SQLite databas
Page 5 and 6: 1. Introduction Our team at CrySyS
Page 7 and 8: 5409 Tue Oct 11 23:35:34 2011 5409
Page 9 and 10: 2. Main components 2.1. Modules We
Page 11 and 12: ~rf.tmp Contains full file listing
Page 13 and 14: 3. Activation and propagation 3.1.
Page 15 and 16: w services winlogon 2. Boot32cfg w:
Page 17 and 18: 3.3. Injections There are multiple
Page 19 and 20: Vad Tag: VadS Protection: PAGE_EXEC
Page 21 and 22: 3.5. Mutexes Similarly to other mal
Page 23 and 24: Figure 13 shows the URL used to dow
Page 25 and 26: 204 204 205 3 206 171 207 147 208 2
Page 27 and 28: int __usercall sub_1000D9DC(int res
Page 29 and 30: 0000330: d9e3 c883 3e30 c885 3dcc 1
Page 31 and 32: 0 0 1 2 3 4 5 6 79 7 8 9 A B 6a C 6
Page 33 and 34: 23:35:39,6313420 rundll32.exe 2388
Page 35 and 36: 0000000EF0: 00 00 00 00 00 00 00 00
Page 37: Further investigations on these fil
Page 41 and 42: 5. C&C communication C&C communicat
Page 43 and 44: SINGLE_CMD_RUNNER Figure 41 - To691
Page 45 and 46: Flask: Attacks can be Jimmy or Flas
Page 47 and 48: Here is a brief overview of the ava
Page 49 and 50: Event Id 673: - Refers to Service T
Page 51 and 52: libplugins.luac libwmi.luac main_ap
Page 53 and 54: Figure 48 -dstrlog structure, part
Page 55 and 56: Figure 50 -dstrlog structure, part
Page 57 and 58: 7.3. Malware’s own files list sKy
Page 59 and 60: ExposureIndicating.25 soapr32.ocx E
Page 61 and 62: ExposureIndicating.132 mixercfg.dat
Page 63 and 64: Possible other related parts from d

sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?